Salting and Key Stretching
Summary
PDF p.76Salting and key stretching enhance the security of password-derived cryptographic keys by increasing entropy and making brute force and dictionary attacks more difficult. Salting adds a unique value to each password before hashing, while key stretching repeatedly processes the key to make it more complex and time-consuming to crack.
In plain words
Supplementary — not from your PDFA salt is random data added to each password before hashing, so two people with the same password get different hashes and precomputed tables stop working. Key stretching hashes thousands of times to make every guess slow.
Detailed explanation
PDF p.76-
Salting
- Purpose: Adds a unique, random value (salt) to each password before hashing to increase entropy and prevent identical hash values for identical passwords.
-
Process
- Hash Computation: (salt + password) * SHA = hash.
- Unique Salt: Generated for each user account.
- Security: Prevents use of precomputed hash tables (rainbow tables).
-
Key Stretching
- Purpose: Converts a password-derived key into a longer and more disordered key through multiple rounds of hashing.
-
Process
- Initial Key: Generated from a password and salt.
- Repeated Hashing: Thousands of rounds to increase complexity.
- Security: Slows down brute force attacks by increasing computational effort.
- Implementation: Often performed using software libraries like Password-Based Key Derivation Function 2 (PBKDF2), used in Wi-Fi Protected Access (WPA).
Important terms
taken from the text above- Hash Computation
- (salt + password) * SHA = hash.
- Unique Salt
- Generated for each user account.
- Initial Key
- Generated from a password and salt.
- Repeated Hashing
- Thousands of rounds to increase complexity.
Examples & real-world scenarios
Supplementary — not from your PDF- A unique random salt stored next to each password hash.
- PBKDF2 running many rounds of hashing (used in WPA).
- The same password giving different stored hashes for different users.
Scenario
Two websites lose their password databases. One stored fast unsalted hashes; the other used salted PBKDF2 with many iterations. The second site's users are far safer, because each guess is slow and must be made separately for every salt.
Common mistakes
Supplementary — not from your PDF- Reading '(salt + password) * SHA' literally. It means hash(salt + password), not multiplication.
- Thinking the salt must be secret. It's stored openly; its job is uniqueness.
Practical skills
Supplementary — not from your PDF- Explain how salting defeats rainbow tables.
What I should remember
Key Points PDF p.76-
Salting
- Unique Value: Added to each password.
- Hash Computation: (salt + password) * SHA = hash.
- Prevents: Identical hash values for identical passwords.
- Security: Mitigates brute force and dictionary attacks.
-
Key Stretching
- Repeated Hashing: Converts key into a longer, more complex key.
- Slows Attacks: Increases computational effort for attackers.
- Implementation: PBKDF2, used in WPA.